Red Hat Security Advisory: OpenShift Container Platform 4.14.2 packages and security update

Fixed packages 10

Vulnerabilities 8

• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• High 7.5
  CVE-2023-39325 Public exploit

  HTTP/2 rapid reset can cause excessive work in net/http

  A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress requ…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 11, 2023
• Unscored —
  CVE-2023-29406 Public exploit

  Insufficient sanitization of Host header in net/http

  The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Reque…

  Go standard library net/http katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jul 11, 2023
• Unscored —
  CVE-2023-29409 Public exploit

  Large RSA keys can cause high CPU usage in crypto/tls

  Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Aug 2, 2023
• Unscored —
  CVE-2023-39318

  Improper handling of HTML-like comments in script contexts in html/template

  The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be imprope…

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 8, 2023
• Unscored —
  CVE-2023-39319

  Improper handling of special tags within script contexts in html/template

  The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, …

  Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 8, 2023
• Unscored —
  CVE-2023-39321

  Panic when processing post-handshake message on QUIC connections in crypto/tls

  Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

  Go standard library crypto/tls go stdlib Alpine Wolfi Go
  Sep 8, 2023
• Unscored —
  CVE-2023-39322

  Memory exhaustion in QUIC connection handling in crypto/tls

  QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in …

  Go standard library crypto/tls go stdlib Alpine Wolfi Go
  Sep 8, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/security/vulnerabilities/RHSB-2023-003
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2222167
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2228743
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237773
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237776
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237777
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2237778
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242803
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2243296
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6840.json
• report
  https://access.redhat.com/security/cve/CVE-2023-29406
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-29406
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-29406
• article
  https://groups.google.com/g/golang-announce/c/2q13H6LEEx0
• report
  https://access.redhat.com/security/cve/CVE-2023-29409
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-29409
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-29409
• article
  https://go.dev/cl/515257
• article
  https://go.dev/issue/61460
• article
  https://groups.google.com/g/golang-announce/c/X0b6CsSAaYI/m/Efv5DbZ9AwAJ
• advisory
  https://pkg.go.dev/vuln/GO-2023-1987
• report
  https://access.redhat.com/security/cve/CVE-2023-39318
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39318
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39318
• article
  https://go.dev/cl/526156
• article
  https://go.dev/issue/62196
• article
  https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
• article
  https://vuln.go.dev/ID/GO-2023-2041.json
• report
  https://access.redhat.com/security/cve/CVE-2023-39319
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39319
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39319
• article
  https://go.dev/cl/526157
• article
  https://go.dev/issue/62197
• article
  https://vuln.go.dev/ID/GO-2023-2043.json
• report
  https://access.redhat.com/security/cve/CVE-2023-39321
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39321
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39321
• article
  https://go.dev/cl/523039